{
  "id": 7845961,
  "title": "Solana Durable Nonces: The Transaction That Never Expires",
  "url": "https://urgent.news/2026/09/16/solana-durable-nonces-the-transaction-that-never-expires",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-16T18:40:58.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/sulimanmukhtar/solana-durable-nonces-the-transaction-that-never-expires-ca4"
  },
  "original_language": "en",
  "account": "On 1 April 2026, the perpetuals protocol Drift suffered a loss of approximately $285 million. The attacker did not exploit a contract or steal a server key. Instead, they phished two signatures from the security council, then submitted two pre-signed transactions that were executed four slots apart. The post-mortem explained that the authorization occurred at the moment of signing, not execution. This introduces the concept of \"durable nonce,\" a Solana feature that users often overlook and wallets rarely mention.\n\nEvery ordinary Solana transaction includes a recent blockhash, which grants the network only 150 slots (about a minute) to accept it. A durable nonce substitutes the blockhash with a value stored in a small on-chain account owned by the system program. This account remains valid until someone advances it, allowing a transaction built on it to remain valid for days or months without expiry.\n\nThe transaction that advances the nonce carries the fee rate at the time of the last advancement, charging that rate when the transaction executes. A nonce can only be advanced once per slot, so multiple pre-signed transactions require separate nonce accounts. Since December 2026, the runtime no longer tracks nonce transactions in its status cache, removing the need for a replay protection signal.\n\nTo stop malicious users from creating a pool of immortal transactions, the RPC node gives each nonce transaction an artificial deadline of the current block height plus 150, dropping it from the retry pool after that. However, the transaction remains valid; the node simply stops retrying it.\n\nDurable nonces serve specific purposes, such as hardware and offline signing, multisig, scheduled payments, and custody flows. They help avoid the one-minute expiry issue. The main hazard lies in the existence of pre-signed transactions that never expire, which can be a standing capability once leaked.\n\nThe kill switch involves advancing the nonce account, invalidating all unsent transactions on that nonce, and allowing the authority to execute them. Wallet simulators cannot show these dormant transactions, nor does the on-chain record of the signed transaction exist. The only way to audit this is by listing nonce accounts and checking if all transactions have been executed. The reverse hazard occurs when the UpgradeNonceAccount instruction migrates a legacy nonce, potentially revealing transactions that were not sent.\n\nThe underlying rule resides on the leader side: a transaction claiming to use a durable nonce but with an incorrectly sized nonce account is dropped by the leader.",
  "summary": "Originally published on xroot.dev . On 1 April 2026, the perpetuals protocol Drift lost about $285 million. The attacker did not break a contract or steal a key from a server. Over several weeks they phished two of the five signatures on the protocol's security council, and then, at a time of their choosing, submitted two transactions that had been signed long before, four slots apart. The…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}